As always, thanks to those who give a little back for their support!

FORENSIC ANALYSIS

• David Spreadborough at Amped
  Closed-Box CCTV Acquisition Using Network Access
  
  
• Cado Security
  • Is Cloud Forensics just Log Analysis? Kind Of.
  • Updates to Legion: A Cloud Credential Harvester and SMTP Hijacker
    
    
• Cyber Triage
  Inbound Logon Artifact Deep Dive Series
  
  
• Data Forensics
  • DD File Forensics and Analysis Using an Automated Software
  • E01 Forensic Analysis Using a Tried & Tested Solution
  • Gmail Email Forensic Analysis Using a Tried & Tested Solution
  • Email Forensics – An Art of Extracting and Examining Email Evidence
    
    
• Eric Capuano
  VMware Memory Analysis with MemProcFS
  
  
• Forensafe
  Workspaces in ArtiFast
  
  
• Joshua Hickman at ‘The Binary Hick’
  iOS 15 Image Now Available.  Finally.
  
  
• Mailxaminer
  Is Message-ID Helpful for Forensic Email Analysis?
  
  
• Amber Schroader at Paraben Corporation
  Different Android Flavors and Forensic Processing
  
  
• Chad Tilbury at SANS
  Finding Evil WMI Event Consumers with Disk Forensics
  
  
• Dave Melvin at Sumuri
  Open Source Tools & Mac Forensics
  
  
• John Scott-Railton, Bill Marczak, Bahr Abdul Razzak, Nicola Lawford, and Ron Deibert at The Citizen Lab
  Confirmation & Research Note 1: Pegasus infections in Armenian Civil Society
  
  
• The DFIR Report
  IcedID Macro Ends in Nokoyawa Ransomware
  

THREAT INTELLIGENCE/HUNTING

• Adam at Hexacorn
  DeXRAY, DFIR, and the art of ambulance chasing…
  
  
• Adam Goss
  Python Threat Hunting Tools: Part 4 — Browser Automation
  
  
• Allen West at Akamai
  The Dark Frost Enigma: An Unexpectedly Prevalent Botnet Author Profile
  
  
• Anomali
  Anomali Cyber Watch: CloudWizard Targets Both Sides in Ukraine, Camaro Dragon Trojanized ​​TP-Link Firmware, RA Group Ransomware Copied Babuk
  
  
• Any.Run
  ChatGPT for SOC and Malware Analysis professionals: 3 Real-World Use Cases 
  
  
• Francis Guibernau, Andrew Costis, and Giovanni López at AttackIQ
  Response to CISA Advisory (AA23-144A): China State-Sponsored Actor Volt Typhoon Living off the Land to Evade Detection
  
  
• Jeremy Fuchs at Avanan
  The Magic Link Attack
  
  
• Avertium
  The Money Message Group – A New Ransomware Threat
  
  
• Bitdefender
  Bitdefender Threat Debrief
  
  
• Lawrence Abrams at BleepingComputer
  QBot malware abuses Windows WordPad EXE to infect devices
  
  
• Brad Duncan at Malware Traffic Analysis
  • 2023-05-23 – Pikabot infection with Cobalt Strike
  • 2023-05-22 – Pikabot infection with Cobalt Strike
  • 2023-05-24 – Bye bye Pikabot… We’re back to Qak! (obama264 Qakbot infection)
    
    
• Brendan Chamberlain at InfosecB
  • Introducing LOOBins
  • GPT-4 Assisted Detection Engineering
    
    
• BushidoToken
  Unmasking Ransomware Using Stylometric Analysis: Shadow, 8BASE, Rancoz
  
  
• CERT Ukraine
  Шпигунська активність UAC-0063 у відношенні України, Казахстану, Киргизстану, Монголії, Ізраїлю, Ірану, Індії (CERT-UA#6549)
  
  
• CERT-AGID
  • Perchè destano preoccupazione i nuovi domini .zip?
  • Analisi tecnica e considerazioni sul malware Strela
  • Sintesi riepilogativa delle campagne malevole nella settimana del 20 – 26 maggio 2023
    
    
• Check Point Research
  • Cloud-Based Malware Delivery: The Evolution of GuLoader
  • 22nd May – Threat Intelligence Report
  • Agrius Deploys Moneybird in Targeted Attacks Against Israeli Organizations
    
    
• CISA
  • CISA and Partners Update the #StopRansomware Guide, Developed through the Joint Ransomware Task Force (JRTF)
  • People’s Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection
    
    
• Cisco’s Talos
  • Mercenary mayhem: A technical analysis of Intellexa’s PREDATOR spyware
  • What is a web shell?
  • Threat Roundup for May 19 to May 26
    
    
• Schyler Gallant, Alex Geoghagan, and Cobi Aloia at Cofense
  Top Malware Trends of April
  
  
• Csaba Fitzl at ‘Theevilbit’
  Beyond the good ol’ LaunchAgents – 31 – BSM audit framework
  
  
• CyberCX
  Cyber Adviser Newsletter – May 2023
  
  
• Cyble
  • New Ransomware Wave Engulfs over 200 Corporate Victims
  • New MDBotnet Unleashes DDoS Attacks
  • Notable DDoS Attack Tools and Services Supporting Hacktivist Operations in 2023
  • Obsidian ORB Ransomware Demands Gift Cards as Payment
  • Invicta Stealer Spreading Through Phony GoDaddy Refund Invoices
    
    
• Cyborg Security
  • Building an Effective Threat Hunting Report Template
  • The Art of Drafting a Stellar Threat Hunting Report: A Deep Dive
    
    
• Cyfirma
  Weekly Intelligence Report – 26 May 2023
  
  
• Cyjax
  Threat actors targeting Israel and India
  
  
• DomainTools
  The Most Prolific Ransomware Families: 2023 Edition
  
  
• Dragos
  The 2022 ICS/OT Vulnerability Briefing Recap
  
  
• Elliptic
  Chinese Businesses Fueling the Fentanyl Epidemic Receive Tens of Millions in Crypto Payments
  
  
• Esentire
  • PaperCut Vulnerability Exploited to Deliver Cryptocurrency Miner to Education Sector Customer
  • eSentire Threat Intelligence Malware Analysis: Vidar Stealer
  • BatLoader Impersonates Midjourney, ChatGPT in Drive-by Cyberattacks
    
    
• Fortinet
  • WINTAPIX: A New Kernel Driver Targeting Countries in The Middle East
  • Operation “Total Exchange”: New PowerExchange Backdoor Discovered in the UAE
    
    
• Nick Sundvall at Infoblox
  Infoblox Researchers Uncover Malicious Domains Hosting Cryptocurrency Scams
  
  
• Alison Rusk at INKY
  Fresh Phish: ChatGPT Impersonation Fuels a Clever Phishing Scam
  
  
• Jouni Mikkola at “Threat hunting with hints of incident response”
  Turla
  
  
• Ryan at Jumpsec Labs
  Hunting for ‘Snake’
  
  
• Andrew Shelton at K7 Labs
  Akira Ransomware Unleashing Chaos using Conti Leaks
  
  
• David Carmiel at KELA
  An Executive’s Guide To The Cybercrime Underground
  
  
• Dex at Lab52
  Quarterly Threat Report Q1 2023
  
  
• LockBoxx
  Red Team Story Time!
  
  
• Logpoint
  • Grand Theft Auto: Vice Society
  • Uncoiling the Enigma of Russian Intelligence’s “Snake Malware”
    
    
• Malwarebytes Labs
  • Malvertising via brand impersonation is back again
  • Employee guilty of joining ransomware attack on his own company
    
    
• Mandiant
  • Don’t @ Me: URL Obfuscation Through Schema Abuse
  • COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises
    
    
• Michael Koczwara
  APT 29 Initial Access Killchain -MITRE ATT@CK Mapping
  
  
• Microsoft
  Volt Typhoon targets US critical infrastructure with living-off-the-land techniques
  
  
• Microsoft’s ‘Security, Compliance, and Identity’ Blog
  • Advanced hunting for Microsoft Purview Data Loss Prevention (DLP) incidents
  • Learn to defend against threats with Microsoft Defender and Microsoft Sentinel
    
    
• Mark E. Haase and Tiffany Bergeron at MITRE-Engenuity
  ATT&CK Sync: A Tool for Keeping Current with MITRE ATT&CK®
  
  
• Monty Security
  Hunting Lazarus Group’s TTPs
  
  
• Palo Alto Networks
  • Cold as Ice: Unit 42 Wireshark Quiz for IcedID
  • Threat Brief: Attacks on Critical Infrastructure Attributed to Volt Typhoon
    
    
• Phylum
  • Phylum Detects Suspicious Publications Surrounding Popular Python Package Flask
  • Respawning Malware Persists on PyPI
  • PyPI New Account Suspension Pauses Attacks
    
    
• Proofpoint
  Account Compromise, Financial Theft, and Supply Chain Attacks: Analyzing the Small and Medium Business APT Phishing Landscape in 2023
  
  
• Red Canary
  Intelligence Insights: May 2023
  
  
• Robin Dimyan
  CTI Playbooks: Cyber crime intelligence
  
  
• S2W Lab
  Detailed Analysis of CloudDon, Cloud Data Breach of Korea e-commerce company
  
  
• SANS Internet Storm Center
  • Another Malicious HTA File Analysis – Part 3, (Sun, May 21st)
  • Probes for recent ABUS Security Camera Vulnerability: Attackers keep an eye on everything., (Mon, May 22nd)
  • Help us figure this out: Scans for Apache “Nifi”, (Tue, May 23rd)
  • More Data Enrichment for Cowrie Logs, (Wed, May 24th)
  • IR Case/Alert Management, (Wed, May 24th)
  • Using DFIR Techniques To Recover From Infrastructure Outages, (Fri, May 26th)
  • DocuSign-themed email leads to script-based infection, (Sat, May 27th)
    
    
• Giampaolo Dedola at Securelist
  Meet the GoldenJackal APT group. Don’t expect any howls
  
  
• Secureworks
  Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations
  
  
• Adrià Alavedra at Security Art Work
  Monstruos de río: Phishing
  
  
• Security Investigation
  • Incident Response For Common Attack Types
  • Cybersecurity Playbook for SOC
    
    
• Sekoia
  Bluenoroff’s RustBucket campaign
  
  
• SentinelOne
  • SOC Team Power Up | 7 Practical Tips To Find and Stop Threats Faster with SentinelOne
  • Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit
  • Operation Magalenha | Long-Running Campaign Pursues Portuguese Credentials and PII
    
    
• SOCRadar
  ChatGPT for CTI Professionals
  
  
• Rianna MacLeod at Sucuri
  What Is a Keylogger?
  
  
• Symantec Enterprise
  Buhti: New Ransomware Operation Relies on Repurposed Payloads
  
  
• Nigel Douglas at Sysdig
  Day 2 Falco Container Security – Tuning the Rules
  
  
• Stefan P. Bargan at System Weakness
  APT Groups — Vietnam — Part II
  
  
• Team Cymru
  What to learn more about NetFlow?  Here’s a useful analogy to get you started
  
  
• Trend Micro
  • BlackCat Ransomware Deploys New Signed Kernel Driver
  • Future Exploitation Vector: File Extensions as Top-Level Domains
  • Info Stealer Abusing Codespaces Puts Discord Users at Risk
  • Against the Clock: Cyber Incident Response Plan
  • Abusing Web Services Using Automated CAPTCHA-Breaking Services and Residential Proxies
  • New Info Stealer Bandit Stealer Targets Browsers, Wallets
    
    
• Trustwave SpiderLabs
  • Microsoft Encrypted Restricted Permission Messages Deliver Phishing
  • From Response To Request, Adding Your Own Variables Inside Of GraphQL Queries For Account Take Over
  • Analyzing the NTC Vulkan Leak: What it Says About Russia’s Cyber Capabilities
    
    
• VMRay
  Bumblebee: A year in the hive
  
  
• Kleiton Kurti at White Knight Labs
  Unleashing the Unseen: Harnessing the Power of Cobalt Strike Profiles for EDR Evasion
  
  
• Zach Stanford
  A Tale of Greatness
  
  
• Zscaler ThreatLabz
  Ransomware Notes
  

UPCOMING EVENTS

• Swachchhanda Shrawan Poudel at Logpoint
  Webinar: Vice Society’s Double Extortion – Demanding Ransom and Threatening Data Leaks
  
  
• Carlos Canto at Rapid7
  VeloCON 2023: Submissions Wanted!
  
  
• SANS
  • SANS Threat Analysis Rundown | Katie Nickels
  • Top 5 Reasons to Attend SANS Blue Team Summit 2023
    

PRESENTATIONS/PODCASTS

• Belkasoft
  iOS Brute-Force: Now Free!
  
  
• Black Hills Information Security
  • Part 1-Gathering Credentials Through Network Based Attacks | Serena DiPenti
  • Part 2-Gathering Credentials Through Network Based Attacks | Serena DiPenti
  • Talkin’ About Infosec News – 5/26/2023
    
    
• Breaking Badness
  155. Sunburst Your Bubble
  
  
• Cellebrite
  • Digital Forensics Tools: How to view the status of a data extraction in Physical Analyzer ULTRA?
  • Mobile Device Forensics: Do I need to reacquire a device when a new version of UFED is released?
  • Mobile Device Forensics: How to troubleshoot the device connection with Cellebrite UFED
  • Mobile Device Forensics: New features in UFED that assist to connect a mobile device
  • Episode 7: The Collaboration Podcast: IACIS x Cellebrite – Forensic Insights from the Frontlines
  • A Detective’s “Need to Know More” Drives Digital Transformation for Monroe CT Police Department
    
    
• Detections by SpectreOps
  • Episode 33: Casey Smith (Part 2)
  • DCP Live – Session 8
    
    
• Digital Forensic Survival Podcast
  DFSP # 379 – New Process Creation
  
  
• Forensic Focus
  Programming Languages, Flipper And Gaming
  
  
• InfoSec_Bret
  IR – SOC180-130 – BianLian Ransomware Detected
  
  
• John Hubbard at ‘The Blueprint podcast’
  Strategy 3: Build a SOC Structure to Match Your Organizational Needs
  
  
• Jon DiMaggio at Analyst1
  On-Demand Webinar: The Lord Has Fallen
  
  
• Karsten Hahn at Malware Analysis For Hedgehogs
  Malware Analysis – Auto Start Monitoring and Disinfection with Autoruns
  
  
• Magnet Forensics
  How to Delete an Evidence Source in Magnet REVIEW
  
  
• MSAB
  • How to Perform Rapid Hash Matching in XRY?
  • XRY: XRY Photon
    
    
• OALabs
  Understanding The PEB for Reverse Engineers
  
  
• Richard Davis at 13Cubed
  A File’s Life – File Deletion and Recovery
  
  
• SANS
  • Stay Ahead of Ransomware Livestream Series – Episode 2
  • A Visual Summary of SANS Cybersecurity Leadership Summit 2023
    
    
• The Cyber Social Hub
  Unique Exploits and Solutions in XRY & XRY Pro
  
  
• The Defender’s Advantage Podcast
  Threat Trends: UNC961 and How Managed Defense Approaches Threat Hunting
  
  
• Velocidex Enterprises
  • Velociraptor: Digging Deeper at the Auscert 2023 Workshop. Part 1
  • Velociraptor: Digging Deeper at the Auscert 2023 Workshop. Part 2
  • Velociraptor: Digging Deeper at the Auscert 2023 Workshop. Part 3
    

MALWARE

• 0day in {REA_TEAM}
  [Case study] Decrypt strings using Dumpulator
  
  
• ASEC
  • Distribution of Remcos RAT Exploiting sqlps.exe Utility of MS-SQL Servers
  • Kimsuky Group Using Meterpreter to Attack Web Servers
  • Kimsuky Group’s Phishing Attacks Targetting North Korea-Related Personnel
  • StrelaStealer Being Distributed To Spanish Users
  • Lazarus Group Targeting Windows IIS Web Servers
  • DarkCloud Infostealer Being Distributed via Spam Emails
  • ASEC Weekly Phishing Email Threat Trends (May 7th, 2023 – May 13th, 2023)
  • CVE Trend Report – March 2023 Vulnerability Statistics and Major Issues
  • March 2023 Threat Trend Report on Kimsuky Group
  • Threat Trend Report on Ransomware – March 2023
  • March 2023 Deep Web & Dark Web Threat  Trend Report
  • ASEC Weekly Malware Statistics (May 15th, 2023 – May 21st, 2023)
  • Analysis of Attack Cases: From Korean VPN Installations to MeshAgent Infections
    
    
• c3rb3ru5d3d53c
  [65] Malware Lab – Reverse Engineering String Decryption Algorithms with Ghidra
  
  
• Erik Pistelli at Cerbero
  Obfuscated Batch Scripts in OneNote Document
  
  
• ClearSky Cyber Security
  Fata Morgana: Watering hole attack on shipping and logistics websites
  
  
• Cluster25
  Back in Black: BlackByte Ransomware returns with its New Technology (NT) version
  
  
• Bret at Cyber Gladius
  Deobfuscate PowerShell From Real-World Incident
  
  
• dr4k0nia
  NixImports a .NET loader using HInvoke
  
  
• Igor Skochinsky at Hex Rays
  Igor’s Tip of the Week #142: Mapping local types
  
  
• Igal lytzki at Toxin Labs
  Kraken – The Deep Sea Lurker Part 2
  
  
• InfoSec Write-ups
  • Ghidra — A powerful Reverse Engineering Tool
  • Reverse Engineering a binary with IDA Free
    
    
• Lab52
  GuLoader as the Gatekeeper of AgentTesla: A Comprehensive Analysis
  
  
• Jakub Kaloč at WeLiveSecurity
  Shedding light on AceCryptor and its operation
  
  
• Zhassulan Zhussupov
  • Malware development trick – part 29: Store binary data in registry. Simple C++ example.
  • Malware development trick – part 30: Find PID via NtGetNextProcess. Simple C++ example.
    
    
• Nikolaos Pantazopoulos and Brett Stone-Gross at ZScaler
  Technical Analysis of Pikabot
  

MISCELLANEOUS

• Belkasoft
  Sneak peek of Belkasoft X v.2.0
  
  
• Brian Maloney
  The curious case of  ♪ and ◙
  
  
• Joshua Thompson-Lindley at Cado Security
  How we Sped up Acquiring Forensic Data From Managed Kubernetes Services by 97% by Rebuilding the SDK
  
  
• Monica Harris at Cellebrite
  The Risks of Losing Data: Why Legal Hold for Text and Chat Data is Crucial
  
  
• Dr. Ali Hadi at ‘Binary Zone’
  Memory Forensics – RansomCare Investigation Case 1
  
  
• Forensic Focus
  Digital Forensics Round-Up, May 25 2023
  
  
• Ken Pryor at No Pryor Knowledge
  Accomplishments and Goals
  
  
• Revo4n6
  Managing Evidence and Investigations with Cellebrite Guardian
  
  
• SANS
  Cybersecurity Jobs: Technical Director (Japanese)
  

SOFTWARE UPDATES

• Acelab
  The New PC-3000 Flash Software Ver. 8.1.x has been released
  
  
• Brim
  v1.1.0
  
  
• Doug Burks at Security Onion
  Security Onion 2.3.250 now available including Elastic 8.7.1, Grafana 9.2.17, Suricata 6.0.12, Zeek 5.0.9, FleetDM 4.31.1, and more!
  
  
• Drew Alleman
  DataSurgeon 1.1.4
  
  
• Eric Zimmerman
  ChangeLog
  
  
• Federico Lagrasta
  PersistenceSniper v1.12.0
  
  
• Alexis Brignoni
  iLEAPP v1.18.7
  
  
• Manabu Niseki
  Mihari v5.2.3
  
  
• Martin Willing
  MemProcFS-Analyzer-v0.9
  
  
• Metaspike
  Remote Authenticator for Mac 2.0.1 Release Notes
  
  
• Passmark Software
  OSForensics V10.0 Build 1013 26th May 2023
  
  
• Martin Korman
  Regipy 3.1.6
  
  
• SpecterOps
  FOSS BloodHound 4.3.1 release
  
  
• Google
  timesketch 20230526
  
  
• Velociraptor
  Release 0.6.9
  
  
• Xways
  • X-Ways Forensics 20.8 SR-1
  • X-Ways Forensics 20.9 Preview 3
    

And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!